mirror of
https://github.com/moons-14/dotfiles.git
synced 2026-10-06 08:28:11 +09:00
84 lines
2.4 KiB
Nix
84 lines
2.4 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
primaryUser,
|
|
...
|
|
}:
|
|
|
|
let
|
|
homeDirectory = "/home/${primaryUser}";
|
|
fleetDirectory = "${homeDirectory}/srv/nix-fleet";
|
|
stateDirectory = "/var/lib/nix-fleet";
|
|
sourceDirectory = "${stateDirectory}/source";
|
|
|
|
git = "${pkgs.git}/bin/git";
|
|
nix = "${config.nix.package}/bin/nix";
|
|
rsync = "${pkgs.rsync}/bin/rsync";
|
|
|
|
cleanCheckoutConditions = [
|
|
"${git} -C ${fleetDirectory} diff --quiet"
|
|
"${git} -C ${fleetDirectory} diff --cached --quiet"
|
|
];
|
|
in
|
|
{
|
|
systemd.services.nix-fleet-converge = {
|
|
description = "Update inputs, build the fleet, and deploy changed hosts";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
|
|
environment = {
|
|
HOME = homeDirectory;
|
|
NIX_CONFIG = ''
|
|
accept-flake-config = true
|
|
max-jobs = 4
|
|
cores = 3
|
|
'';
|
|
};
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = primaryUser;
|
|
Restart = "on-failure";
|
|
RestartSec = "5min";
|
|
StateDirectory = "nix-fleet";
|
|
StateDirectoryMode = "0750";
|
|
WorkingDirectory = stateDirectory;
|
|
UMask = "0077";
|
|
ExecCondition = cleanCheckoutConditions;
|
|
EnvironmentFile = "${fleetDirectory}/.env";
|
|
|
|
# Work in a disposable copy so updating the dotfiles lock never dirties
|
|
# the operator's nix-fleet checkout.
|
|
ExecStart = [
|
|
"${git} -C ${fleetDirectory} pull --ff-only"
|
|
"${rsync} --archive --delete --exclude=.git/ --exclude=.direnv/ --exclude=.env --exclude=result --exclude=result-* ${fleetDirectory}/ ${sourceDirectory}/"
|
|
"${nix} flake update --flake ${sourceDirectory} dotfiles"
|
|
"${nix} run ${sourceDirectory}#converge -- ${sourceDirectory} ${stateDirectory}"
|
|
];
|
|
};
|
|
};
|
|
|
|
systemd.timers.nix-fleet-converge = {
|
|
description = "Periodically converge the NixOS fleet";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "2min";
|
|
OnUnitInactiveSec = "5min";
|
|
RandomizedDelaySec = "30s";
|
|
Persistent = true;
|
|
Unit = "nix-fleet-converge.service";
|
|
};
|
|
};
|
|
|
|
# Only an actual successful deployment touches gc-request. This starts the
|
|
# builder's root nh-clean unit; remote host stores are never cleaned here.
|
|
systemd.paths.nix-fleet-gc = {
|
|
description = "Garbage-collect superseded fleet builds on nix-builder";
|
|
wantedBy = [ "multi-user.target" ];
|
|
pathConfig = {
|
|
PathChanged = "${stateDirectory}/gc-request";
|
|
Unit = "nh-clean.service";
|
|
};
|
|
};
|
|
}
|